GHSA-cr3w-cw5w-h3fj
Critical · 9.6CVSS
9.6
EPSS
—
Published
Jan 26, 2026
CISA due date
—
The record
Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @saltcorn/server | 1.1.1 | 1.5.0-beta.19 |
Related vulnerabilities
- CVE-2026-42259 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- CVE-2026-41478 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- GHSA-f3g8-9xv5-77gv Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url`… Also affects @saltcorn/server
- GHSA-jp74-mfrx-3qvh Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) Also affects @saltcorn/server
- GHSA-32pv-mpqg-h292 Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file… Also affects @saltcorn/server
- CVE-2026-40163 Saltcorn is an extensible, open source, no-code database application builder. Also affects @saltcorn/server
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-77
- CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-77